# Creating an Allowlist for Phishing Simulations in Microsoft 365

WatchDog Security Automated Phishing Campaigns simulate real phishing attacks to train users and identify risk.  

Microsoft 365 (Exchange Online Protection) will block these emails by default, as they resemble real phishing attempts. To ensure successful delivery, you must configure an allowlist using **Advanced Delivery Policies**.

## Configure Advanced Delivery

:::info[]
This configuration ensures phishing simulations bypass Microsoft Defender filtering.
:::

<Steps>

<Step title="Open Microsoft Defender">
  Navigate to [**Microsoft Defender Portal**](https://security.microsoft.com/advanceddelivery).
</Step>

<Step title="Open Advanced Delivery">
  Go to **Email & Collaboration → Policies & Rules → Threat Policies → Advanced Delivery**.
</Step>

<Step title="Edit Phishing Simulation">
  Select the **Phishing Simulation** tab and click **Edit**.
</Step>

<Step title="Add Domains">
  Enter the following domains under **Domain**:
  `secalerts.ca`, `tlsprotect.ca`, `norepiy.ca`, `portal-login.fyi`, `Authenticati0n.ca`, `account-login.ca`
</Step>

<Step title="Add Sending IP">
  Enter `69.147.224.210` under **Sending IP**.
</Step>

<Step title="Save Configuration">
  Click **Save** to apply the allowlist settings.
</Step>

</Steps>

## Configure Mail Flow Rule (Optional)

:::tip[]
Only required if using WatchDog Email Security Firewall.
:::

<Steps>

<Step title="Open Exchange Admin">
  Navigate to [**Exchange Admin Center**].(https://admin.cloud.microsoft/exchange#/homepage)
</Step>

<Step title="Open Mail Flow Rules">
  Go to **Mail Flow → Rules**.
</Step>

<Step title="Create New Rule">
  Click **Add a rule** and select **Create a new rule**.
</Step>

<Step title="Name The Rule">
  Enter **WatchDog Security Phishing Simulation Allowlist**.
</Step>

<Step title="Set Sender Condition">
  Set **The sender → IP address is** and enter **69.147.224.210**.
</Step>

<Step title="Set Message Header">
  Select **Modify message properties → Set a message header** and enter **X-CLOUD-SEC-AV-Info**.
</Step>

<Step title="Set Header Value">
  Enter **[portalname],office365_emails,inline** replacing **[portalname]**.
</Step>

<Step title="Bypass Spam Filtering">
  Set **Spam Confidence Level (SCL)** to **Bypass spam filtering**.
</Step>

<Step title="Enable Rule">
  Set **Rule mode** to **Enforce** and enable the rule.
</Step>

<Step title="Set Priority">
  Set **Priority** to **0** and save the rule.
</Step>

</Steps>



## What Happens Next

<TipInfo>Phishing simulation emails bypass Microsoft 365 filtering controls.</TipInfo>
<TipInfo>Users receive phishing simulations directly in their inbox.</TipInfo>
<TipInfo>Email delivery reliability improves for automated campaigns.</TipInfo>
<TipInfo>Campaign results accurately reflect user behavior.</TipInfo>



## Troubleshooting

<AccordionGroup>

<Accordion title="Phishing Emails Still Going to Spam" defaultOpen>
If emails are still being filtered:

- Verify domains are added correctly in **Advanced Delivery**  
- Confirm the **Sending IP** is correct  
- Check if additional security tools are overriding policies  
</Accordion>

<Accordion title="Advanced Delivery Option Missing">
If you cannot find Advanced Delivery:

- Ensure you are in the **Microsoft Defender Portal**  
- Verify you have appropriate admin permissions  
</Accordion>

<Accordion title="Mail Flow Rule Not Working">
If the mail flow rule is not effective:

- Confirm the rule is **Enabled**  
- Ensure **Priority is set to 0**  
- Verify IP and header values are correct  
</Accordion>

<Accordion title="Emails Blocked by External Security Tools">
If emails are still blocked:

- Check third-party email security tools  
- Add WatchDog domains and IPs to external allowlists  
</Accordion>

</AccordionGroup>